Method and system for determining the location of an unlicensed mobile access subscriber

ABSTRACT

A method and system for locating an unlicensed mobile access (UMA) subscriber. The method enables a user of a mobile station comprising a hand-set or the like that supports voice and data access via both licensed and unlicensed radio spectrums to be located. Accordingly, services requiring location information, such as 911 services, may be accessed when operating the mobile station under both UMA and licensed wireless network (e.g., cellular) sessions.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a Continuation in Part of U.S. Nonprovisionalapplication Ser. No. 11/013,883, entitled “Apparatus and Method forExtending the Coverage Area of A Licensed Wireless Communication SystemUsing an Unlicensed Wireless Communication System,” filed Dec. 15, 2004,which is a Continuation in Part of U.S. Nonprovisional application Ser.No. 10/688,470, entitled “Apparatus and Method for Extending theCoverage Area of a Licensed Wireless Communication System Using anUnlicensed Wireless Communication System,” filed Oct. 17, 2003 now U.S.Pat. No. 7,127,250.

This application is also related to commonly owned U.S. applications:Ser. No. 10/115,833, entitled “Unlicensed Wireless Communications BaseStation to Facilitate Unlicensed and Licensed Wireless Communicationswith a Subscriber Device, and Method of Operation,” filed Apr. 2, 2002;and application Ser. No. 10/251,901, entitled “Apparatus for Supportingthe Handover of a Telecommunication Session between a Licensed WirelessSystem and an Unlicensed Wireless System,” filed Sep. 20, 2002, thecontents of each of which are hereby incorporated by reference.

FIELD OF THE INVENTION

The field of invention relates generally to telecommunications. Moreparticularly, this invention relates to a technique for determining thelocation of a mobile station accessing a core network via an unlicensedwireless system.

BACKGROUND INFORMATION

Licensed wireless systems provide mobile wireless communications toindividuals using wireless transceivers. Licensed wireless systems referto public cellular telephone systems and/or Personal CommunicationServices (PCS) telephone systems. Wireless transceivers include cellulartelephones, PCS telephones, wireless-enabled personal digitalassistants, wireless modems, and the like.

Licensed wireless systems utilize wireless signal frequencies that arelicensed from governments. Large fees are paid for access to thesefrequencies. Expensive base station (BS) equipment is used to supportcommunications on licensed frequencies. Base stations are typicallyinstalled approximately a mile apart from one another (e.g., cellulartowers in a cellular network). The wireless transport mechanisms andfrequencies employed by typical licensed wireless systems limit bothdata transfer rates and range. As a result, the quality of service(voice quality and speed of data transfer) in licensed wireless systemsis considerably inferior to the quality of service afforded by landline(wired) connections. Thus, the user of a licensed wireless system paysrelatively high fees for relatively low quality service.

Landline (wired) connections are extensively deployed and generallyperform at a lower cost with higher quality voice and higher speed dataservices. The problem with landline connections is that they constrainthe mobility of a user. Traditionally, a physical connection to thelandline was required.

In the past few years, the use of unlicensed wireless communicationsystems to facilitate mobile access to landline-based networks have seenrapid growth. For example, such unlicensed wireless systems may supportwireless communication based on the IEEE 802.11a, b or g standards(WiFi), or the Bluetooth™ standard. The mobility range associated withsuch systems is typically on the order of 100 meters or less. A typicalunlicensed wireless communication system includes a base stationcomprising a wireless access point (AP) with a physical connection(e.g., coaxial, twisted pair, or optical cable) to a landline-basednetwork. The AP has a RF transceiver to facilitate communication with awireless handset that is operative within a modest distance of the AP,wherein the data transport rates supported by the WiFi and Bluetooth™standards are much higher than those supported by the aforementionedlicensed wireless systems. Thus, this option provides higher qualityservices at a lower cost, but the services only extend a modest distancefrom the base station.

Currently, technology is being developed to integrate the use oflicensed and unlicensed wireless systems in a seamless fashion, thusenabling a user to access, via a single handset, an unlicensed wirelesssystem when within the range of such a system, while accessing alicensed wireless system when out of range of the unlicensed wirelesssystem. However, this introduces a problem with respect to userlocation, particularly for emergency services. While there are knowntechniques for locating a user's mobile device (e.g., cell phone) whenaccessing a licensed wireless system (cellular network), theimplementation model for unlicensed wireless systems prevents thelocation of a user from being easily ascertained. For example, a typicalcellular network is managed by a single entity (or multiple entitiessharing management responsibilities), enabling the location of a mobiledevice to be determined via built-in network infrastructure. Incontrast, wireless access points are typically deployed by individualusers or companies, and often only provide private access. Thus, thereis no single management entity that is able to control access to and useof unlicensed wireless systems. Accordingly, there is no existinginfrastructure for determining the location of users accessingunlicensed wireless networks.

SUMMARY OF THE INVENTION

In accordance with aspects of the present invention, a method and systemfor locating an unlicensed mobile access (UMA) subscriber is disclosed.The method enables a user of a mobile station comprising a hand-set orthe like that supports voice and data access via both licensed andunlicensed radio spectrums to be located. Accordingly, servicesrequiring location information, such as emergency services (e.g., userdials 911), may be accessed when operating the mobile station under bothUMA and cellular sessions.

In accordance with one embodiment, the subscriber employs a mobilestation (MS) supporting both UMA and GSM sessions to establish a UMAsession with a UMA service provider. The UMA session is facilitated by abase station comprising a wireless access point (AP) employing anunlicensed radio frequency spectrum and an UMA network controller (UNC),operatively coupled to the AP via an access network. Informationidentifying the AP is forwarded to the UNC. The UNC then performs alookup operation in a database managed by the UMA service provider todetermine if a record identifying the location of the AP is present. Ifsuch a record is not present or is out of date, UNC submits a locationservice request to a GSM-based location service to identify the locationof the MS using the aforementioned known techniques for locating auser's mobile device when accessing a licensed GSM wireless system. Oncethe location of the MS is obtained, corresponding information isreturned to the UNC and a record linking the location of the AP servingthe MS is stored in a service provisioning server database managed bythe UMA service provider.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing aspects and many of the attendant advantages of thisinvention will become more readily appreciated as the same becomesbetter understood by reference to the following detailed description,when taken in conjunction with the accompanying drawings, wherein likereference numerals refer to like parts throughout the various viewsunless otherwise specified:

FIG. 1A provides an overview of the indoor access network (IAN) mobileservice solution in accordance with one embodiment of the presentinvention;

FIG. 1B illustrates protocol layers of a mobile set in accordance withone embodiment;

FIG. 1C illustrates a method of protocol conversion in accordance withone embodiment;

FIG. 2A illustrates an overview of a level 1, level 2, and level 3GSM-related protocol architecture for one embodiment of a mobile stationthat provides unlicensed radio links via Bluetooth signaling;

FIG. 2B illustrates an overview of a level 1, level 2, and level 3GSM-related protocol architecture for one embodiment of a mobile stationthat provides unlicensed radio links via IEEE 802.11 signaling;

FIG. 3A illustrates the Up interface protocol architecture in support ofCS Domain signaling, as well as UMA-specific signaling, according to oneembodiment;

FIG. 3B shows Bluetooth lower layers employed by a mobile station andaccess point to facilitate physical layer communications;

FIG. 3C shows Bluetooth lower layers employed by a mobile station andaccess point to facilitate physical layer communications;

FIG. 3D illustrates the Up CS domain voice bearer protocol architecturein support of GSM voice transmission, according to one embodiment;

FIG. 3E illustrates the Up GPRS user plane protocol architecture,according to one embodiment;

FIG. 3F illustrates the Up protocol architecture in support of GPRSSignaling, according to one embodiment;

FIG. 4 illustrates several possible GSM and UMA coverage scenarios inaccordance with one embodiment;

FIG. 5 illustrates exemplary mobility management functions in oneembodiment;

FIG. 6 illustrates a reference model for enhanced emergency servicesupport in accordance with one embodiment;

FIG. 7 illustrates a system architecture to support UMA locationservices via GSM location service infrastructure, according to oneembodiment;

FIG. 8 is a message and data flow diagram illustrating messages andoperations employed to facilitate location of a UMA subscriber,according to one embodiment;

FIG. 9A illustrates operations and logic to support emergency locationservices via a UMA session, according to one embodiment; and

FIG. 9B illustrates operations and logic to support emergency locationservices via a UMA session, according to another embodiment.

DETAILED DESCRIPTION

Embodiments of methods and apparatus for determining the location of auser while accessing an unlicensed wireless system are described herein.In the following description, numerous specific details are set forth toprovide a thorough understanding of embodiments of the invention. Oneskilled in the relevant art will recognize, however, that the inventioncan be practiced without one or more of the specific details, or withother methods, components, materials, etc. In other instances,well-known structures, materials, or operations are not shown ordescribed in detail to avoid obscuring aspects of the invention.

Reference throughout this specification to “one embodiment” or “anembodiment” means that a particular feature, structure, orcharacteristic described in connection with the embodiment is includedin at least one embodiment of the present invention. Thus, theappearances of the phrases “in one embodiment” or “in an embodiment” invarious places throughout this specification are not necessarily allreferring to the same embodiment. Furthermore, the particular features,structures, or characteristics may be combined in any suitable manner inone or more embodiments.

The present invention is directed towards seamlessly providing thelocation of a mobile station (MS) using both a licensed wireless systemand an unlicensed wireless system. The unlicensed wireless system is ashort-range wireless system, which may be described as an “indoor”solution. However, it will be understood through the application thatthe unlicensed wireless system includes unlicensed wireless systems thatcover not only a portion of a building but also local outdoor regions,such as outdoor portions of a corporate campus serviced by an unlicensedwireless system. The mobile station may, for example, be a wirelessphone, smart phone, personal digital assistant, or mobile computer. The“mobile station” may also, for example, be a fixed wireless deviceproviding a set of terminal adapter functions for connecting IntegratedServices Digital Network (ISDN) or Plain Old Telephone Service (POTS)terminals to the wireless system. Representative of this type of deviceis the Phonecell line of products from Telular Corporation of Chicago,Ill. Application of the present invention to this type of device enablesthe wireless service provider to offer so-called landline replacementservice to users, even for user locations not sufficiently covered bythe licensed wireless system.

Throughout the following description, acronyms commonly used in thetelecommunications industry for wireless services are utilized alongwith acronyms specific to the present invention. A table of acronymsspecific to this application is included in Appendix I.

FIG. 1A illustrates an Unlicensed Mobile Access (UMA) architecture 100in accordance with one embodiment of the present invention. UMAarchitecture 100 enables a user of a mobile station 102 to access avoice and telecommunications network 104 via either a licensed wirelesscommunications session 106, or an unlicensed wireless communicationsession 108. The telecommunications network 104 includes a mobileswitching center (MSC) 110, which provides access to a voice network112, and a Serving GPRS (General Packet Radio Service) Support Node(SGSN) 114, which provides access to a data network 116. MSC 110 alsoprovides an internal visitor location register (VLR) function, asexplained in further detail below.

In further detail, the licensed wireless communication session isfacilitated by infrastructure provided by a licensed wireless network118 that includes telecommunications network 104. In the illustratedembodiment, licensed wireless network 118 depicts components common to aGSM-(Global System for Mobile Communication) based cellular network thatincludes multiple base transceiver stations (BTS) 120 (of which only oneis shown for simplicity) that facilitate wireless communication servicesfor various mobile stations 102 via respective licensed radio links 122(e.g., radio links employing radio frequencies within a licensedbandwidth). Typically, the multiple BTSs 120 are configured in acellular configuration (one per each cell) that covers a wide servicearea. The various BTSs 120 for a given area or region are managed by abase station controller (BSC) 124, with each BTS 120communicatively-coupled to its BSC 124 via a private trunk 126. Ingeneral, a large licensed wireless network, such as that provided by aregional or nationwide mobile services provider, will include multipleBSCs 124.

Each BSC 124 communicates with telecommunications network 104 through astandard base station controller interface 126. For example, a BSC 124may communicate with MSC 110 via the GSM A-interface for circuitswitched voice services and with SGSN 114 via the GSM Gb interface forpacket data services (GPRS). Conventional licensed voice and datanetworks 104 include protocols to permit seamless handoffs from onerecognized BSC 124 to another BSC (not shown).

An unlicensed communication session 108 is facilitated via an (wireless)access point (AP) 128 comprising an indoor base station 130. Typically,AP 128 will be located in a fixed structure, such as a home 132 or anoffice building 134. In one embodiment, the service area of indoor basestation 130 includes an indoor portion of a building, although it willbe understood that the service area of an indoor base station mayinclude an outdoor portion of a building or campus. As indicated by thearrow representing unlicensed communication session 108, the mobilestation 102 may be connected to the telecommunications network 114 via asecond data path that includes an unlicensed wireless channel 136,access point 128, an access network 138, and an unlicensed mobile accessnetwork controller (UNC) 140. The UNC 140 communicates withtelecommunications network 104 using a base station controller interface126B that is similar to base station controller interface 126A, andincludes a GSM A interface and Gb interface. As described below in moredetail, indoor base station 128 and indoor network controller 132 mayinclude software entities stored in memory and executing on one or moremicroprocessors (not shown in FIG. 1A) adapted to perform protocolconversion.

As described below in more detail, indoor base station 128 and UMAnetwork controller 140 may include software entities stored in memoryand executing on one or more microprocessors (not shown in FIG. 1A)adapted to perform protocol conversion.

The unlicensed wireless channel 136 is facilitated by a radio linkemploying a wavelength (or wavelength range) in an unlicensed, freespectrum (e.g., spectrum around 2.4 GHz, 5 GHz, 11-66 GHz). Anunlicensed wireless service hosting unlicensed wireless channel 136 mayhave an associated communication protocol. As examples, the unlicensedwireless service may be a Bluetooth™ compatible wireless service, or awireless local area network (LAN) (WiFi) service (e.g., the IEEE802.11a, b, or g wireless standard). This provides the user withpotentially improved quality of service in the service regions of theunlicensed wireless service (i.e., within the service range of acorresponding AP). Thus, when a subscriber is within range of theunlicensed AP, the subscriber may enjoy low cost, high speed, and highquality voice and data services. In addition, the subscriber enjoysextended service range since the handset can receive services deepwithin a building at locations that otherwise may not be reliablyserviced by a licensed wireless system. At the same time, the subscribercan roam outside the range of the unlicensed AP without droppingcommunications. Instead, roaming outside the range of the unlicensed APresults in a seamless handoff (also referred to as a handover) whereincommunication services are automatically provided by the licensedwireless system, as described in more detail in U.S. patent applicationSer. No. 10/115,833, the contents of which are hereby incorporated byreference.

In one embodiment, mobile station 102 includes a microprocessor andmemory (not shown) that stores computer program instructions forexecuting wireless protocols for managing communication sessions. Asillustrated in FIG. 1B, in one embodiment the mobile station 102includes a layer 1 protocol layer 142, layer 2 protocol layer 144, and alayer 3 signaling protocol layer for the licensed wireless service thatincludes a radio resource (RR) sublayer 146, a mobility management (MM)sublayer 148, and a call management (CM) layer 150. It will beunderstood that the level 1, level 2, and level 3 layers may beimplemented as software modules, which may also be described as software“entities.” In accordance with a common nomenclature for licensedwireless services, layer 1 is the physical layer, i.e., the physicalbaseband for a wireless communication session. The physical layer is thelowest layer of the radio interface and provides functions to transferbit streams over physical radio links. Layer 2 is the data link layer.The data link layer provides signaling between the mobile station andthe base station controller. The RR sublayer is concerned with themanagement of an RR-session, which is the time that a mobile station isin a dedicated mode, as well as the configuration of radio channel,power controller, discontinuous transmission and reception, andhandovers. The mobility management layer manages issues that arise fromthe mobility of the subscriber. The mobility management layer may, forexample, deal with mobile station location, security functions, andauthentication. The call control management layer provides controls forend-to-end call establishment. These functions for a licensed wirelesssystem are well known by those in the art of wireless communication.

In one embodiment of the present invention, the mobile station alsoincludes an unlicensed wireless service physical layer 152 (i.e., aphysical layer for unlicensed wireless service such as Bluetooth, WiFi,or other unlicensed wireless channel (e.g., WiMAX)). The mobile stationalso includes an unlicensed wireless service level 2 link layer 154, andan unlicensed wireless service radio resource sublayer(s) 156. An accessmode switch 160 is included for the mobile management 148 and callmanagement layers 150 to access the unlicensed wireless service radioresource sublayer 156 and unlicensed wireless service link layer 154when the mobile station 102 is within range of an unlicensed AP 128 andto support switching between licenced RR sublayer 146 and unlicensedwireless service RR sublayer 156.

The unlicensed radio resource sublayer 156 and unlicensed link layer 154may include protocols specific to the unlicensed wireless serviceutilized in addition to protocols selected to facilitate seamlesshandoff between licensed and unlicensed wireless systems, as describedbelow in more detail. Consequently, the unlicensed radio resourcesublayer 156 and unlicensed link layer 154 need to be converted into aformat compatible with a conventional base station controller interfaceprotocol 126 recognized by a MSC, SGSN, or other voice or data network.

Referring to FIG. 1C, in one embodiment of the present invention, themobile station 102, AP 128 and UNC 140 provide an interface conversionfunction to convert the level 1, level 2, and level 3 layers of theunlicensed service into a conventional base station subnetwork (BSS)interface 126B (e.g., an A-interface or a Gb-interface). As a result ofthe protocol conversion, a communication session may be established thatis transparent to the voice network/data network 104, i.e., thevoice/data network 104 uses its standard interface and protocols for thecommunication session as it would with a conventional communicationsession handled by a conventional base transceiver station. For example,in some embodiments the mobile station 102 and UNC 140 are configured toinitiate and forward location update and service requests. As a result,protocols for a seamless handoff of services that is transparent tovoice/data network 104 are facilitated. This permits, for example, asingle phone number to be used for both the licensed wireless serviceand the unlicensed wireless service. Additionally, the present inventionpermits a variety of services that were traditionally offered onlythrough licensed wireless services to be offered through an unlicensedwireless service. The user thus gets the benefit of potentially higherquality service when their mobile station is located within the areaserviced by a high bandwidth unlicensed wireless service while alsohaving access to conventional phone services.

The licensed wireless service may comprise any licensed wireless servicehaving a defined BSS interface protocol 126 for a voice/data network104. In one embodiment, the licensed wireless service is a GSM/GPRSradio access network, although it will be understood that embodiments ofthe present invention include other licensed wireless services. For thisembodiment, the UNC 140 interconnects to the GSM core network via thesame base station controller interfaces 126 used by a standard GSM BSSnetwork element. For example, in a GSM application, these interfaces arethe GSM A-interface for circuit switched voice services and the GSM Gbinterface for packet data services (GPRS). In a UMTS (Universal MobileTelecommunications System) application of the invention, the UNC 140interconnects to the UMTS network using a UMTS Iu-cs interface forcircuit switched voice services and the UMTS Iu-ps interface for packetdata services. In a CDMA application of the invention, the UNC 140interconnects with the CDMA network using the CDMA A1 and A2 interfacesfor circuit switched voice services and the CDMA A10 and A11 interfacesfor packet data services.

In a GSM/GPRS embodiment, UNC 140 appears to the GSM/GPRS core networkas a GSM BSS network element and is managed and operated as such. Inthis architecture the principle elements of transaction control (e.g.,call processing) are provided by higher network elements; namely the MSC110 visitor location register (VLR) and the SGSN 114. Authorized mobilestations are allowed access to the GSM/GPRS core network either directlythrough the GSM radio access network if they are outside of the servicearea of an AP 128 or via the UMA network system if they are within theservice area of an AP.

Since a communication session hosted by the UMA architecture 100 istransparent to a voice network 112 or data network 116, the unlicensedwireless service may support all user services that are typicallyoffered by a wireless service provider. In the GSM case, this typicallyincludes the following basic services: Telephony; Emergency call (e.g.,E911 calling in North America); Short message, mobile-terminatedpoint-to-point (MT/PP); Short message, mobile-originated point-to-point(MO/PP); GPRS bearer services; Handover (outdoor-to-indoor,indoor-to-outdoor, voice, data, SMS, SS). Additionally, GSM may alsosupport, various supplementary services that are well-known in the art.

FIG. 2A provides an overview of a level 1, level 2, and level 3GSM-related protocol architecture for one embodiment of mobile station102 that provides unlicensed radio links via Bluetooth signaling. Asillustrated, there are two logical radio resource (RR) managemententities: the GSM RR entity 202 and the UMA-RR entity 204. The protocolarchitecture includes a GSM baseband level 1 layer 206, GSM level 2 linklayer (LAPDm) 208, Bluetooth baseband level 1 layer 210, Bluetooth level2 layers 211 including a layer 2 connection access procedure (L2CAP)layer 212 and a BNEP layer 213, an access mode switch 214, and upperlayer protocols 216. When the mobile station is operating in an UMAmode, the UMA-RR entity 204 is the current “serving” RR entity providingservice to the mobility management (MM) sublayer via the designatedservice access point (RR-SAP). The GSM RR entity is detached from the MMsublayer in this mode. The UMA-RR entity 204 provides a new set offunctions, and is responsible for several tasks. First the UMA-RR entityis responsible for discovery of UMA coverage and UMA registration.Second, the UMA-RR entity is responsible for emulation of the GSM RRlayer to provide the expected services to the MM layer; i.e., create,maintain and tear down RR connections. In one embodiment, all existingGSM 04.07 primitives defined for the RR-SAP apply. The plug-in of UMA-RRentity 204 is made transparent to the upper layer protocols in this way.Third, a UMA-RR entity 204 module is responsible for coordination withthe GSM RR entity to manage access mode switching and handover, asdescribed in further detail in application Ser. No. 10/688,470referenced above.

FIG. 2B provides an overview of a level 1, level 2, and level 3GSM-related protocol architecture for one embodiment of mobile station102 that provides unlicensed radio links via IEEE 802.11 signaling. Allof the entities and layers are the same as described above for FIG. 2A,except that the Bluetooth layers have been replaced with an 802.11 PHYlayer 218 and an 802.11 MAC layer 220.

FIG. 3A illustrates the Up interface protocol architecture in support ofcircuit switched (CS) Domain signaling, as well as UMA-specificsignaling, according to one embodiment. The MSC sublayers areconventional, well known features known in the art in regards to themessage transfer part (MTP) interfaces MTP1 302, MTP2 304, and MTP3 306,signaling connection control part (SCCP) 308, base station systemapplication part (BSSAP) 310, mobility management interface 312, andconnection management interface 314.

The UMA-RR protocol supports the UMA “layer 3” signaling functions viaUMA-RR layers 204 provided by each of the mobile station 102 and UNC140. The UNC 140, acting like a BSC, terminates UMA-RR protocol messagesand is responsible for the interworking between these messages and theanalogous A-interface messages.

The layers below the UMA-RR layer 204 in each of mobile station 104 andUNC 140 include a TCP layer 316, a remote IP layer 318, and an IPSec (IPsecurity) layer 320. As an option, a standard Secure Socket Layer (SSL)protocol running over TCP/IP (not shown) may be deployed in place ofIPSec layer 320.

Lower-level IP connectivity between mobile station 102 and UNC 140 issupported by appropriate layers hosted by an intervening access point128 and broadband IP network 138 (i.e., the access network 138 shown inFIG. 1A). The components for supporting the IP transport layer (i.e.,the conventional network layer 3 under the seven-layer OSI model)include a transport IP layers 322 for each of the mobile station 104, AP128, and IP network 138, and an IP layer 322A at UNC 140.

At the lowest layers (i.e., the physical and data link layers), mobilestation 104 and AP 128 are depicted as providing unlicensed lower layers324, while each of AP 128, IP network 138, and UNC 140 provideappropriate access layers 326. Typically, access layers 326 will includeconventional Ethernet PHY and MAC layers (IEEE 802.3), although this isnot limiting.

As shown in FIGS. 3A and 3B, the unlicensed layers lower layers 324 willdepend on whether the unlicensed radio link uses Bluetooth signaling orIEEE 802.11 signaling. The Bluetooth lower layers depicted in FIG. 3Acorrespond to the mobile station architecture of FIG. 2A, and include aBluetooth baseband layer 210, an L2CAP layer 212, and a BNEP layer 213.Meanwhile, the 801.11 lower layers shown in FIG. 3B correspond to themobile station architecture of FIG. 2B, and include a 802.11 PHY layer218 and in 802.11 MAC layer 220.

FIG. 3D illustrates the Up CS domain voice bearer protocol architecturein support of GSM voice transmission, according to one embodiment. Inaddition to the like named and referenced components common to thearchitectures of FIGS. 3D and 3C, facilities are provided for supportingGSM voice transmission. For the MSC 110, these components includeconventional components for supporting GSM voice transmissions, and aredepicted as physical layers 330 and audio 332, with similar componentsbeing deployed in UNC 140. Each of mobile station 102 and UNC 140 nowinclude a GERAN (GSM Edge Radio Access Network) codec 334 and an RTP/UDPlayer 336.

Under the architecture of FIG. 3D, audio flows over the Up interfaceaccording to the RTP framing format defined in RFC 3267 and RFC 3551.When operating in UMA mode, support for AMR FR as specified in TS 26.103is supported. Other codecs may also be supported, such as G.711.

FIG. 3E illustrates the Up GPRS user plane protocol architecture,according to one embodiment. The Up GPRS user plane protocolarchitecture effectively enables the tunneling of GPRS signaling anddata packets through the UNC 140 utilizing the unlicensed spectrum, thussupporting a tunneling function for packet-switched traffic between themobile station 102 and SGSN 118.

As illustrated in FIG. 3E, each of the UNC 140 and SGSN 114 employconventional facilities for supporting GPRS signaling and data packets,including a physical layer 350, a network service layer 352, and a BSSGPlayer 354. Each of mobile station 102 and UNC 140 include a UDP layer356 and a UMA-RLC layer 358. Each of mobile station 102 and SGSN includean LLC layer 360 and an SNDCP layer 362. Mobile station 102 alsoincludes an IP layer 364.

Under the architecture of FIG. 3E, GPRS LLC PDUs carrying data, andhigher layer protocols, are carried transparently between the mobilestation 102 and SGSN 114. This allows the mobile station to derive allGPRS services in the same manner as if it were in a GERAN BSS. Allexisting GPRS applications and MMI in mobile station 102 are unchanged.LLC PDUs are carried over UMA-RLC layer 358 from mobile station 102 toUNC 140, which relays the PDUs over to SGSN 114 using BSSGP messaging.The UMA-RLC layer 358 runs directly over the UDP layer 356 to leveragethe IP bearer service.

FIG. 3F illustrates the Up protocol architecture in support of GPRSSignaling, according to one embodiment. Under this architecture, theGPRS LLC PDUs for signaling an higher layer protocols (including upperlayers 366) are carried transparently between MS 102 and SGSN 114. Thisallows the MS to obtain all GPRS services in the same ways as if it wereconnected to a GERAN BSS. The GPRS-RLC protocol is replaced with anequivalent (from the upper layer perspective) UMA-RLC protocol.Reliability is ensured by TCP layer 357. As in a GERAN BSS, the UNC,acting like a BSC, terminates the UMA-RLC protocol and inter-works it tothe Gb-interface using BSSGP.

As noted above, the mobile station may be, for example, a wirelessphone, smart phone, personal digital assistant, or mobile computer. Themobile station may also be, for example, a fixed wireless deviceproviding a set of terminal adapter functions for connecting IntegratedServices Digital Network (ISDN) or Plain Old Telephone Service (POTS)terminals to the wireless system.

Other terminal adapter types than those listed above may be employedwith embodiments of the present invention. For example: (1) a terminaladapter that supports cordless telephones rather than POTS phones; (2) aterminal adapter that supports standard Session Initiation Protocol(SIP) telephones; and (3) a terminal adapter that also integrates acorded handset and user interface, such as one would find on a deskphone. Representative of the latter type of device is the Phonecell®SX5D Fixed Wireless Phone from Telular Corporation of Chicago, Ill. Ineach case, the invention described herein describes how these terminaladapter functions can be connected to the wireless system via theunlicensed network.

The use of other standard Bluetooth capabilities together withembodiments of the present invention is possible. For example, there isa Bluetooth standard capability called “SIM Access Profile” that allowsone Bluetooth device (e.g., an embedded cell phone subsystem in a car)to access the SIM that is in another Bluetooth device (e.g., the user'snormal cell phone), allowing the first device to take on the“personality” associated with the SIM (i.e., that of the user's normalcell phone). The embodiments described above could make use of thisstandard capability to give the terminal adapter-attached devices (e.g.,a POTS phone) the personality of the user's cell phone.

Mobility Management

In one embodiment, and as described in greater detail below, the UNC 140provides functions equivalent to that of a GSM BSC, and as such controlsone or more (virtual) UMA cells. In one embodiment, there may be asingle UMA cell per UNC and, in an alternative embodiment, there may beone UMA cell per access point connected to a UNC. The latter embodimentmay be less desirable due to the large number of APs expected to beused, so the UMA architecture permits flexible groupings of APs into UMAcells. In one embodiment, each UMA cell may be identified by a cellglobal identifier (CGI), with an unused absolute radio frequency channelnumber (ARFCN) assigned to each UMA cell. Each UMA cell may be mapped toa physical boundary by associating it with specific GSM location areasserved by the MSC. GSM cells within the location areas mapped to an UMAcell are configured with ARFCN-to-CGI mappings for that UMA cell.Further, this ARFCN may be advertised in the BA list by the GSM cells topermit handovers. Note that UMA cells may use the same location areaidentifiers (LAI) as existing GSM cells, or a new LAI may be used forUMA cells. The latter is useful in reducing paging in GSM cells when amobile station is known to be registered via an INC. The abovediscussion applies equally to GPRS routing areas and routing areaidentifiers (RAIs).

UMA CPE Addressing

In one embodiment, customer premise equipment (CPE) includes the mobilestation and the access point (AP) through which the mobile station mayaccess the UNC for UMA service. UMA CPE addressing parameters mayinclude the parameters described below.

In one embodiment, the UMA CPE addressing includes the internationalmobile subscriber identity (IMSI) associated with the SIM in the mobileequipment as a parameter. In one embodiment, the IMSI is provided by theUMA mobile station to the UNC when it requests UMA service via the Upinterface to the UNC. Unlike the GSM BSC, the UNC manages a context foreach mobile station that is operating in UMA mode. Therefore, the UNCmaintains a record for each served mobile station. For example, IMSI maybe used by the UNC to find the appropriate mobile station record whenthe UNC receives a BSSMAP paging message.

In one embodiment, the UMA CPE addressing includes the addressassociated with the unlicensed interface in the mobile equipment (e.g.,802.11 MAC address) as a parameter. This identifier may be provided bythe UMA mobile station to the UNC when it requests UMA service via theUp interface. The UNC may use this address as an alternative to the IMSIto limit the transfer of the IMSI over the Up interface and to assist inthe routing of messages.

In one embodiment, the UMA CPE addressing includes the temporary logicallink identifier (TLLI) assigned to the mobile station by the servingGPRS support node (SGSN) as a parameter. This identifier may be providedvia standard Gb-interface procedures. The UNC may track this address foreach served mobile station to support GSM Gb-interface procedures (e.g.,so that downlink GPRS packets may be routed to the correct mobilestation).

In one embodiment, the UMA CPE addressing includes the access point ID(AP-ID) as a parameter. The AP-ID may be the MAC address of theunlicensed mode access point through which the mobile station isaccessing UMA service. This identifier may be provided by the UMA mobilestation to the UNC when it requests UMA service via the Up interface. Inone embodiment, the AP-ID is be used by the UNC to support locationservices (e.g., enhanced 911 service) to the user based on the AP fromwhich the service is being accessed, as described below in furtherdetail. The AP-ID may also be used by the service provider to restrictUMA service access only to authorized APs.

Other CPE addressing parameters that may be used depend on the securityrequirements of the Up interface (e.g., the need to manage UMA mobilestation IP addresses for message routing via tunneled IPSec connections,or the need to manage local credentials assigned to the mobile stationby the UNC).

UMA Cell Identification

In one embodiment, in order to facilitate the mobility managementfunctions in GSMIGPRS, the coverage area is split into logicalregistration areas called location areas (for GSM) and routing areas(for GPRS). Mobile stations may be required to register with the networkeach time the serving location area (or routing area) changes. One ormore location areas identifiers (LAIs) may be associated with eachvisited location register (VLR) in a carrier's network. Likewise, one ormore routing area identifiers (RAIs) may be controlled by a single SGSN.

In one embodiment, a GSM cell is identified within the location orrouting area by adding a cell identity (CI) to the location or routingarea identification. The cell global identification (CGI) is theconcatenation of the location area identification and the cell identity.In one embodiment, the cell identity is unique within a location area.

An Exemplary UMA Approach to Cell Identification

One embodiment of a UMA cell identification approach is described below.In this embodiment, a single UNC provides service for one or more UMAlocation areas and one or more UMA routing areas, and each UMA locationarea (or routing area) is distinct from, or the same as, the locationarea (or routing area) of the overlapping GSM cell. A UMA cell isidentified within the UMA location or routing area by adding a cellidentity (CI) to the location or routing area identification. The UMAcell global identification (UMA-CGI) is the concatenation of thelocation area identification and the cell identity. In one embodiment, aUMA cell may be a pre-defined partition of the overall UMA coverage areaidentified by a UMA-CGI value. Note that cell identification, like UMAinformation, may be transparent to the AP, such that the AP is not awareof its associated UMA-CGI value. The UMA components (e.g., mobilestation and UNC) may support the ability to partition the overall UMAcoverage area.

In one embodiment, a partitioning method may include implementing aone-to-one or a many-to-one correspondence between GSM cell identity andUMA cell identity. Given the identification of a preferred GSM cell in aparticular area, it may be possible to determine the corresponding UMAcell identity based, for example, on UNC provisioning. An example of aone-to-one relationship is mapping a GSM cell to a UMA cell. An exampleof a many-to-one relationship is mapping a GSM location area (andassociated GSM cells) to a UMA cell. This may be required for enhanced911 emergency call routing purposes, as described under “EmergencyServices” below.

In one embodiment, when a UMA mobile station connects to the UNC for UMAservice, it sends the CGI value and a path loss criterion parameter (C1)of the current GSM camping cell, as well as the neighbor cells, to theUNC. The UNC maps the GSM camping cell's CGI value to a correspondingUMA cell's CGI value based on mapping logic provisioned in the UNC. Thismay be a one-to-one mapping (e.g., if there is one UMA cell per GSMcell) or a many-to-one mapping (e.g., if there is one UMA cell per GSMlocation area). If no GSM coverage is available in the UMA service area,the UNC may assign the mobile station to a default “no GSM coverage” UMAcell. A single UNC may serve one MSC. This does not preclude UNCembodiments that combine multiple UNC “instances,” as defined above, ina single device. Each UNC may also be assigned a unique“UMA-Handover-CGI” value used for GSM-to-UMA handover purposes. Forexample, this may be the value provisioned in the GSM RAN BSC'sARFCN-to-CGI tables and in the MSCs (e.g., to point to the UNC).

UMA Operating Configurations

In one embodiment, at least three UMA operating configurations may beidentified. In a common core configuration, the UMA LAI and an umbrellaGSM RAN LAI (e.g., that serves the subscriber's neighborhood) may bedifferent, and the network may be engineered such that the same corenetwork entities (e.g., MSC and SGSN) serve both the UMA cells and theumbrella GSM cells. One advantage of this configuration is thatsubscriber movement between the UMA coverage area and the GSM coveragearea does not result in inter-system (e.g., MAP) signaling (e.g.,location updates and handovers are intra-MSC).

In a separate core configuration, the UMA LAI and umbrella GSM RAN LAIare different, and the network may be engineered such that differentcore network entities serve the UMA cells and the umbrella GSM cells.One advantage of this configuration is that engineering of the UMA andGSM networks can be more independent than in the Common CoreConfiguration.

In a common LAI configuration, the UMA LAI and GSM RAN LAI are the same(e.g., different cells within the same LAI). Advantages of thisconfiguration are that subscriber movement (while idle) between the UMAcoverage area and the GSM coverage area may not result in any locationupdate signaling, and that the mobile station can easily switch to GSMmode if UMA mode resources are temporarily unavailable (e.g., to respondto paging). Further details of this and the foregoing separate coreconfiguration are discussed in application Ser. No. 10/688,470.

UMA Registration and Deregistration

In one embodiment, as described above, a UMA registration process doesnot employ signaling to the PLMN infrastructure and is contained withinthe UMA system (i.e., between the mobile station and UNC). The UMAregistration process may serve at least two purposes. It may inform theUNC that a mobile station is connected through a particular AP and isavailable at a particular IP address. The UNC may keep track of thisinformation, for example, for mobile-terminated calling. Theregistration process may also provide the mobile station with theoperating parameters associated with the UMA service on the AP. This maybe analogous to the use of the GSM broadcast control channel (BCCH) totransmit system parameters to mobile stations in GSM cells. GSM systeminformation message content that is applicable in UMA mode may bedelivered to the mobile station during the UMA registration process.

Similarly, a UMA deregistration process may allow the mobile station toexplicitly inform the UNC that it is leaving UMA mode, allowing the UNCto free resources that it may have assigned to the mobile station. TheUNC may also support implicit UMA deregistration, wherein a securechannel to the mobile station is abruptly terminated.

UMA Redirection

In one embodiment, as described above, when a UMA mobile stationconnects to the UNC for UMA service, it may send a CGI value and a pathloss criterion parameter (C1) of the current GSM camping cell, as wellas the neighbor cells, to the UNC. Using this information, as well asinternal database information, the UNC may be able to determine if it isthe correct serving UNC for the mobile station, and if it is not thecorrect serving UNC, to redirect the mobile station to the correct UNC.The correct serving UNC may be the UNC whose UMA service area overlapsthe mobile station's umbrella GSM coverage. In one embodiment, thecorrect serving UNC might be attached to the same MSC as the GSM BSC towhich the umbrella GSM cell belongs. In an alternative embodiment, thecorrect serving UNC might be attached to a different MSC that mayhand-over to the MSC that provides umbrella GSM coverage to the mobilestation, allowing the UNC to handover calls to and from GSM. It may alsoenable certain location-based services (e.g., E911 Phase 1, as describedbelow) that can be tied to the location of the GSM cell. An internaldatabase used by the UNC may map GSM location areas to serving UNCs andconserve the amount of data that needs to be managed. This database mayonly need to change when a new UNC or a new GSM location area is added.

If no GSM coverage is available when a mobile station connects to theUNC for UMA service, then, under some instances, the UNC may notreliably determine the location of the mobile station for the purposesof assigning the mobile station to the correct serving UNC (e.g., toenable handover and location-based services). The UNC may permit theoperator to determine the service policy in this case (e.g., theoperator may provide service to the user with certain limitations,possibly with a user interface indication on the mobile station).

UMA Mobile Station Idle Mode Behavior

In one embodiment, as described above, a UMA device may encounterdifferent radio environments as illustrated in FIG. 4. In a firstenvironment, the GSM and UMA coverage areas are completely separate andnon-overlapping. In a second environment, the GSM and UMA coverage ispartially overlapping. In a third environment, which may be the mostcommon, the UMA coverage is encapsulated within the GSM coverage. A UMAdevice may power on in any of these environments and further maytransition in a number of attached states.

In one embodiment, at power on, and when the mobile station is idle andthere is no coverage of any type, the mobile station may scan for bothGSM and UMA radio coverage. If GSM coverage is detected, then the normalGSM mobility management procedure may be initiated. This condition mayapply when no UMA coverage has been detected by the mobile station whenGSM coverage is detected, or prior to the completion of the UMAregistration process. If UMA coverage is detected, then the UMA mobilestation establishes an unlicensed wireless link (e.g., WLAN link) to theAP and monitors signal quality. When the received signal level at themobile station passes a predefined threshold, the mobile stationperforms the UMA registration procedure. Based upon the informationreturned, the mobile station may determine if a full networkregistration is required, and if so, what type (e.g., GSM or combinedGSM/GPRS). This procedure may apply when no GSM coverage exists or whenUMA coverage is detected prior to detecting GSM coverage.

In one embodiment, when the mobile station is idle in GSM coverage, andthere is no UMA coverage, the mobile station periodically scans for UMAcoverage. If UMA coverage is detected, the mobile station may initiatethe UMA registration procedure described above.

In one embodiment, when the mobile station is idle in UMA coverage andthere is no GSM coverage, the mobile station continues to perform normalGSM PLMN search procedures. If GSM coverage is detected, the mobilestation may send the GSM cell information to the UNC for possible UMAredirection purposes as described above. Alternatively, the mobilestation may disable normal GSM PLMN search procedures to conserve power.

In one embodiment, when the mobile station is idle in UMA coverage, andthere is GSM coverage, the mobile station may continue to perform normalGSM cell reselection procedures and may store the identification of theselected GSM cell to speed the transition to GSM mode, if required.Alternatively, the mobile station may disable normal GSM cellreselection procedures to conserve power.

In one embodiment, at power off in UMA coverage, a detach indication maybe sent by the mobile station to the PLMN via the UMAN (e.g., ifrequired by the PLMN network or normally sent by the mobile station atpower off). This indication may be encoded per the current GSM mode ofoperation (e.g., GSM or GPRS).

In one embodiment, the UMA environment may be an IEEE 802.11environment. In this case, the mobile station periodically performs anactive scan for available 802.11 APs. When an AP is discovered, it maybe matched against a stored profile of user preferences and securitycredentials, in which case the mobile station may automaticallyassociate with the AP. The mobile station may enter low-power sleepmode, waking up periodically to measure signal quality for determiningwhen to trigger UMA registration.

In one embodiment, the UMA environment may be a Bluetooth environment.In this case, the mobile station previously paired with the Bluetooth APthrough which it will access UMA service. Periodically, the mobilestation may enter a page scan receive mode, and respond to an APtransmit page to establish a link-level connection. Once a link-levelcontrol channel is established, and if the mobile station is nototherwise active, it may enter a low-power Bluetooth state (e.g., parkmode) to conserve power. Periodically, the AP may poll the mobilestation to allow it to re-enter active-power mode. This periodic trafficmay also be used by the mobile station to measure signal quality todetermine when to perform the UMA registration procedure.

UMA Mobile Station Dedicated Mode Behavior

A UMA device engaged in a voice call, a data transaction or asimultaneous voice/data transaction may encounter a transition from GSMcoverage to UMA coverage or a transition from UMA coverage GSM coverage.In one embodiment, when the coverage transitions from GSM to UMAcoverage, calls may be handed over transparently between the GSM RAN andthe UMAN. In the case of voice, the handover may be accomplished by ahandover function. In the case of data, session management controls mayprovide a common end-user experience to that provided in GPRS. Normalregistration actions may occur upon a return to the idle state, ifappropriate. In one embodiment, when the coverage transitions from UMAto GSM coverage, calls may be handed over transparently between the UMANand the GSM RAN. In the case of voice, the handover may be accomplishedby a handover function. In the case of data, session management controlsmay provide a common end-user experience to that provided in GPRS.

Summary of Key Mobility Management Concepts

FIG. 5 illustrates mobility management functions in one exemplaryembodiment. In FIG. 5, unlicensed network controller UNC-1 is theserving UNC for the UMA cells associated with GSM location areas LA-11to LA-23. UNC-1 maps GSM location areas LA-1 x to UMA cell UMA CGI-101and GSM location areas LA-2 x to UMA CGI-102. Unlicensed networkcontroller UNC-3 is the serving UNC for the UMA cells associated withGSM location areas LA-31 to LA-33. UNC-3 maps GSM location areas LA-3 xto UMA cell UMA CGI-301. Mobile station MS-1 will be in UMA cellUMA-CGI-101 (since GSM LA-1 x is mapped to UMA-CGI-101). Mobile stationMS-2 will be in UMA cell UMA-CGI-102 (since GSM LA-2 x mapped toUMA-CGI-102). Mobile station MS-3 will be in UMA cell UMA-CGI-301 (sinceGSM LA-3 x mapped to UMA-CGI-301). If mobile station MS-4 connects toUNC-1, it will be in UMA cell UMA-CGI-199 (no GSM coverage). If MS-4connects to UNC-3, it will be in UMA cell UMA-CGI-399 (no GSM coverage).Mobile stations MS-1 and MS-2 may connect to UNC-1 without redirection.If mobile station MS-3 attempts to connect to UNC-1, it may beredirected to UNC-3.

Location Services for Emergencies and Other Purposes

As described in detail below, location area identification may be usedto support UMA-based emergency services. When a wired caller dials 911,the address and phone number of the caller are displayed on a screen ata 911 service center. Enhanced 911 (E911) provides dispatchers with thelocation of callers and their phone number. This is also known asautomatic number information (ANI) and automatic location information(ALI). The FCC has ordered wireless service providers to address theissue in an effort to improve 911 calling from mobile phones.

In phase one of the E911 requirements, wireless service providers arerequired by the FCC to have the capability to send wireless 911 calls toan E911 public safety answering point (PSAP) containing the location ofthe cell tower through which the E911 call was processed and the mobiledirectory number (MDN) or “call back number” of the wireless phoneplacing the 911 call. In UMA, the emergency call is handled like anormal GSM emergency call origination. The MSC inserts the locationidentifier into the call signaling to the E911 tandem, the call andlocation identifier are delivered to the PSAP, and the PSAP uses theidentifier to look up the cell site's location in the ALI database. Thegranularity of the UMA cell may be chosen to allow appropriate PSAProuting and comparable size as a GSM cell (for reasonable locationresolution).

In phase two of the E911 requirements, wireless service providers arerequired by the FCC to have the ability to send the caller's actuallocation to the E911 PSAP. The location accuracy requirements differdepending on whether a network-based or handset based approach ischosen. The network-based accuracy requirement is within 300 meters 95%of the time and within 100 meters 67% of the time. The handset basedaccuracy requirement is within 150 meters 95% of the time and within 50meters 67% of the time. GSM E911 Phase One Solution

In one embodiment of a GSM E911 phase one solution, a BSC receives a GSM04.08 CM service request message that indicates an emergency callestablishment request from the mobile station. The BSC forwards themessage to the MSC in a GSM 08.08 BSSMAP complete layer 3 information(CL3I) message. The BSC may include the cell global identifier (CGI)associated with the serving cell in the CL3I message. The MSC (orassociated emergency services support system) may map the CGI value itreceives from the BSC into the Emergency Services Routing Number (ESRN)that is statically associated with the cell. The ESRN may be representedas a 10-digit NANP number, and may also be referred to as thepseudo-ANI, or pANI. The MSC may send the call, with the ESRN, to anE911 tandem switch, which may use ESRN to query a selective routingdatabase to come up with an emergency service number (ESN). The E911tandem may use the ESN to route the call to the appropriate PSAP,including the calling user's MSISDN in the ISUP calling party numberparameter and the ESRN in the ISUP generic digits parameter. The PSAPmay use the ESRN to query an ALI database that may return the geographicaddress associated with the cell.

It will be appreciated by one of ordinary skill in the art that otherspecific embodiments are possible. In general, the information neededfor phase one E911 support is the cell identifier that may be providedby the BSC to the MSC. By a series of transformations in the corenetwork, the cell identifier may be mapped into an ESRN value, which thePSAP may use to query an ALI database to determine the geographiclocation information associated with the cell.

UMA Solution for E911 Phase One

In one embodiment, UMA elements (e.g., mobile station and UNC) may betransparent for E911 calls that require phase one location. In oneembodiment, the call may be handled like a normal emergency callorigination. The MSC inserts the UMA cell's location identifier (ESRN)into the call signaling to the E911 tandem, the call and locationidentifier may be delivered to the PSAP, and the PSAP may use theidentifier to look up the cell site's location in the ALI database. Inone embodiment, a UMA cell may be defined to encompass a set of GSMlocation areas belonging to the MSC to which a UNC is attached. However,the serving area of the resulting UMA cell may be too large to providereasonable granularity for emergency services. For example, if the UMAcell is sufficiently large, it may map to more than one PSAP, which maycomplicate PSAP routing.

The partitioning of a physical UMA coverage area associated with a UNC,into multiple UMA cells, is described above under mobility management.As described therein, when a UMA mobile station connects to the UNC forUMA service, it may provide the GSM cell information to the UNC. The UNCmay then map the GSM cell information to a corresponding UMA cell's CGIvalue. This may be a one-to-one mapping (e.g., if there is one UMA cellper GSM cell) or a many-to-one mapping (e.g., if there is one UMA cellper PSAP routing area or one UMA cell per GSM location area). If no GSMcoverage is available in the UMA service area, the UNC assigns themobile station to a default “no GSM coverage” UMA cell, subject torefinement based on AP location information, that may be provided forE911 phase two purposes, as described below. The UNC may provide the UMACGI to the MSC during call establishment, including an emergency call.The MSC (or associated emergency services support system) may map theUMA CGI value into an ESRN value that may be statically associated withthe cell, and that has an entry in the ALI database. For example, ifthere is one UMA cell per GSM cell, then the ESRN for the existing GSMcells is reused and no new ALI database records are needed. In oneembodiment, partitioning of the UNC coverage area into UMA cells may beeliminated if the UNC supports E911 phase two and the core networkemergency services support systems can map the providedlatitude/longitude to a geographic address that can be looked up in theALI database by a phase one PSAP.

GSM E911 Phase Two Requirements

A GSM 1900 approach to E911 phase two support is defined in J-STD-036-A,“Enhanced Wireless 9-1-1, Phase 2.” The condensed network referencemodel is illustrated in FIG. 6 and described below. The Base StationSubsystem (BSS) receives the emergency call from the mobile station andnotifies the visited MSC (VMSC). The BSS is also involved in thehandling of certain positioning procedures. The emergency servicesmessage entity (ESME) routes and processes the out-of-band messagesrelated to emergency calls. This may be incorporated into selectiverouters (also known as routing, bridging and transfer switches) andautomatic location information (ALI) database engines. The emergencyservices network entity (ESNE) routes and processes the voice bandportion of the emergency call. This is composed of selective routers(also known as routing, bridging and transfer switches). The gatewaymobile location center (GMLC) contains functionality required to supportdelivery of a mobile's position to the ESME. The GMLC handles requestsfor a mobile's initial, updated (current) or last known position fromthe ESME. In one PLMN, there may be more than one GMLC. The GMLC sendspositioning requests to and receives final position estimates from thevisited MSC via the Lg interface. The GMLC stores the initial positionestimate to support a non-call associated signaling (NCAS) pulloperation (when the ESME requests the position from the GMLC). Theserving mobile location center (SMLC) manages the overall coordinationand scheduling of resources required to determine a mobile's position.For some position methods, it also calculates the final positionestimate and accuracy. In one PLMN, there may be more than one SMLC. Asdescribed in 3GPP TS 03.71, two types of SMLC are possible; NSS basedSMLC, which supports the Ls interface, and BSS based SMLC, which:supports the Lb interface. An NSS based SMLC supports positioning of atarget mobile station via signaling on the Ls interface to the visitedMSC. A BSS based SMLC supports positioning via signaling on the Lbinterface to the BSC serving the target mobile station. Both types ofSMLC may support the Lp interface to enable access to information andresources owned by another SMLC. A location measurement unit (LMU) makesradio measurements to support the determination of a mobile's position.All position and assistance measurements obtained by an LMU are suppliedto a particular SMLC associated with the LMU. The procedures associatedwith location determination for emergency service purposes are describedin 3GPP TS 03.71.

UMA Solution for E911 Phase Two

Unlike with GSM networks, the base station equivalents (APs) are notcentrally managed by a service provider. In fact, under anticipatedimplementations of some of the embodiments of the UMA technologydiscussed herein, the APs are completely unaware of their even beingused as an AP for UMA services, e.g., a mobile station simply appears asanother WLAN client. Nor do all access models for UMA servicesnecessitate the particular AP be identified beyond the IP address of theAP. Further yet, in some implementations the IP address of the AP doesnot need to be revealed to the UMA service provider, only theidentification of the mobile station needs to be identified.

Consider the following analogy. Under a conventional IP network, data isrouted between endpoints via various routing devices (switches, routers,bridges, etc.). The particular routing devices need not be identified toroute messages—unless schemes such as source routing are used, theparticular route will be dynamically determined by the routing devicesat the time the message is forwarded. A similar situation may occurunder some implementations of UMA service. As discussed above withrespect to the architectures of FIGS. 3A, 3D, and 3E, an access network(comprising a broadband IP network in one embodiment) sits between a UNCand a mobile station. Furthermore, in some embodiments the access pointmerely serves as a wireless extension to the access network. As such,the access point functions as an intermediary routing device, and thusneed not be identified to route data between a mobile station and a UNC.Furthermore, it is anticipated that subscribers may access the UMAnetwork infrastructure via their own personal access points (e.g., a WAPon a home network). As a result, if the user moves the access point as aresult of a family move, choose to move the access point from a homenetwork to an office network or vice versa, etc., any locationinformation the user had previously entered for the access point withhis or her UMA or GSM service provider will no longer be valid. Thus,identifying the location of a mobile station accessing UMA services maypresents some difficulties under various circumstances.

In one embodiment of a UMA solution for E911 Phase Two, the UNCdetermines location information for the AP that the mobile station usesto access the UMA service. When the UMA mobile station performs the UMAregistration procedure described above, one of the parameters that theUNC provides to the mobile station in the response may be a “locationavailable” indicator. If the UNC does not have a location estimate(i.e., latitude and longitude) for the AP, then the indicator is set to“no location is available.” Otherwise, the indicator is set to “locationis available”. “No location is available” would typically be the casethe first time the UMA mobile station connects to the UNC for service.In that case, the user may be informed of the setting of the “locationavailable” indicator via a user interface icon on a display screen inthe mobile station. The mobile station may provide a convenient way forthe user to access an “enter UMA location” function. Invocation of thisfunction may enable the user to enter street address informationassociated with the current location. Once entered, the mobile stationmay send this information to the UNC. The UNC may process theinformation (e.g., performs a geocoding operation) to attempt to derivea location estimate. If this procedure results in the creation of alocation estimate for the AP, then the UNC may store this information ina corresponding AP record, which may also include the AP-ID. When alocation estimate is added to an AP record, and the associated AP isserving one or more UMA mobile stations, the UNC may send a message toeach mobile station with the location available indicator set to thevalue “location is available.” The user may be informed of the change inthe setting of the “location available” indicator via a change to theuser interface icon on the mobile station display screen. Thedescription above is for an embodiment involving user-entered AP addressinformation.

In another embodiment, the WLAN access network supports new locationcapabilities (e.g., those based on DHCP GEOPRIV extensions, as describedin IETF Internet Draft: “draft-ietf-geopriv-dhcp-civil-01”) that providethe street address or geographic location of the AP to the mobilestation, and the mobile station may pass this information to the UNCwhen it connects for UMA service. In one embodiment, the mobile stationcontains GPS technology that may allow it to acquire a positionestimate, which it may pass to the UNC when it connects for UMA service.Once the location information associated with the serving AP is storedin the UNC, E911 phase two location queries may be handled. In oneembodiment, from the core network's perspective, the UNC may provide aBSS-based, serving mobile location center (SMLC) function. When there isa need for phase two location, the MSC may send a BSSMAP PerformLocation-request message to the UNC. The UNC may retrieve the AP'slocation information and respond with a BSSMAP perform-location-responsemessage containing the location estimate. In one embodiment, it may bean operator option to configure the UMA service such that emergencycalls are made via GSM mode if “no location is available”. This optionmay be configured in the UNC and the UNC may include this configurationsetting in the UMA operating parameters sent to the mobile stationduring the UMA Registration process.

In another embodiment, location information for supporting a UMAsolution for E911 Phase Two leverages locator infrastructure common toGSM networks. An exemplary network architecture 700 for implementingthis technique is shown in FIG. 7. Network architecture 700 includesvarious instances of the UMA elements discussed above, including mobilestations 102, access points 128, an IP network 139, a pair of exemplaryUNCs 140, and a pair of exemplary MSCs 110. A respective BSC 124A withan integrated serving mobile locating center (SMLC) is connected to eachof the MSCs 110. In turn, each BSC 124A manages a set of BTSs 120. In anoptional configuration, one or more of the SMLCs may be implemented asseparate elements (i.e., not integrated with an BSC).

In addition to the aforementioned components, network architecture 700further includes a gateway mobile locating center (GMLC) 702, a locationservices (LCS) client network 704, a service provisioning server (SPS)706, and an SPS database 708. The SMLCs and GMLC 702 representconventional infrastructure employed by GSM networks for performinglocation services, and function in a manner similar to that describedabove. The SPS 706 is employed for provisioning UMA services for one ormore service providers. In one embodiment, an SPS is co-located with aUNC or physically integrated in a UNC. In another embodiment, multipleUNCs share access to a common SPS, and are connected to such an SPS viaa high speed access link, such as a Ethernet connection, private trunk,VPN tunnel, or a leased line hosted by public network infrastructure.SPS database 708 is used to store UMA service data, such as subscriberdata, mobile station identifiers and capabilities, access pointinformation, security data, etc.

One embodiment of a message and operation sequence for locating a UMAsubscriber using network architecture 700 is shown in FIG. 8. Thesequence begins at step A, with MS 102 establishing an unlicensedwireless link with AP 128. Next, at step B, MS 102 connects via AP 128and an IP network (not shown) to UNC 140. Then, at step C, MS 102 sendsa URR (UMA Radio Resource) Register Request message that includes the APMAC address and the IMSI for MS 102 to UNC 140. In response, UNC 140forwards the AP MAC address and the MS IMSI to SPS 706 at step D.

In one embodiment, the AP MAC address is used as an AP identifier (APID). Accordingly, at step E, SPS 706 queries SPS database 708 using theAP ID to determine if there is a record in the database that identifiesthe location of the AP. If there is, the location information isreturned. However, for the purpose of illustration, it will be presumedthat no such record initially exists. In this instance, SPS database 708would return a no record or location message to SPS 706 at step F.

In response to determining that no location data for the AP exists, theSPS initiates a location service requests to applicable location serviceinfrastructure. In the illustrated embodiment, SPS 706 submits aLocation Inter-operability Forum Mobile Location Protocol query (LIFMLP) including the IMSI for MS 102 at step G. The LIF TS 101Specification (Version 3.0.0 6 Jun. 2002) defines a secure access methodvia an Application Program Interface (API) that enables Internetapplications to query location information from wireless networks,irrespective of its underlying air interface and positioning methods.The API is based on existing and well-known Internet technologies, suchas HTTP, SSL/TLS and XML. The GMLC functions as a gateway server forlocation services, and hosts an instance of the LIF API. Accordingly,the SPS and the GMLC may perform an authentication message exchange toverify the UNC is authorized to use location services accessed via theGMLC.

Once the authorization is verified, the GMLC obtains locationinformation corresponding to the request using standard licensed networktechniques at a step H. These include, but are not limited to, AssistedGPS (AGPS), Angle of Arrival (AOA), Enhanced Observed Time Difference(E-OD), Cell Identity plus Timing Advance (Cell ID+TA), and TimeDifference of Arrival (TDOA).

In response to obtaining the location information, GMLC 702 returns thelocation information to SPS 706 at step I. The SPS then updates orcreates a new location record for the serving AP (e.g., AP 128) for theMS in SPS database 708 at step J. In essence, the location of the AP isconsidered to be the same as the location information calculated for themobile station accessing the AP. For typical 802.11 and Bluetoothnetworks, the maximum location error relative to the calculated MSlocation (which has some accuracy limitations on its own in view of thelocation technique being employed) will be the range of coverageprovided by the access point.

In conjunction with the foregoing operations at step K, a responsemessage containing the location of the AP is returned to UNC 140, whichmay store the location information in a local data store. UNC 140 thenreturns a URR Register Accept message to MS 102 at step L. Thiscompletes the registration process and the location sequence.

The flowchart of FIG. 9A illustrates operations and logic to supportemergency location services via a UMA session, according to oneembodiment. The process begins in a block 900, wherein an attempt toaccess 911 emergency services via the subscriber's mobile station isdetected. For instance, in this instance the mobile station will beoperating in a voice communication compatible mode, wherein the MSprovides functionality similar to that used when operating in a licensedwireless network session. The subscriber will thus dial 911, and attemptto place the call. Corresponding information will be generated by the MSand forwarded to the UNC. The UNC will trap such calls, and perform theremaining operations shown in FIG. 9A.

In a block 902, the AP hosting the UMA service for the subscriber's MSwill be identified. Then, in a block 904, a determination will be madeto whether the UNC (or UNC operator) has any valid location informationfor the AP (e.g., by a SPS lookup or by a lookup in a local data store).As depicted by a decision block 906, if such a record exists, the APlocation will be forwarded to the 911 emergency service as the locationfor the subscriber. If no record is found, the UNC will submit alocation service request to the location service provider referencing anidentifier for the MS in a manner similar to that discussed above forFIGS. 7 and 8. In response, location information for the MS will bereceived from the location service in a block 912, and the MS locationinformation will be forwarded as the subscriber location to the 911emergency service in a block 914.

An alternate scheme for supporting 911 emergency service locationinformation from a 911 call initiated during a UMA session in shown inFIG. 9B. The operations up to block 908 are the same as those employedby the embodiment of FIG. 9A. However, in this embodiment, a NO answerto decision block 906 causes a hand-over from the UMA session to alicensed wireless network session to be initiated in a block 916.Furthermore, the 911 call is placed in the session queue, such that whenthe licensed wireless network session is established, a 911 call istransparently placed (i.e., the subscriber doesn't have to redial thenumber) to the licensed wireless network, as depicted by a block 918.The licensed wireless network then obtains the location of thesubscriber in its usual manner in a block 920, and the subscriberlocation information is forwarded to the 911 emergency service in ablock 922.

It will be understood that an embodiment of the present inventionrelates to a computer storage product with a computer-readable mediumhaving computer code thereon for performing various computer-implementedoperations. The media and computer code may be those specially designedand constructed for the purposes of the present invention, or they maybe of the kind well known and available to those having skill in thecomputer software arts. Examples of computer-readable media include, butare not limited to: magnetic media such as hard disks, floppy disks, andmagnetic tape; optical media such as CD-ROMs and holographic devices;magneto-optical media such as optical disks; and hardware devices thatare specially configured to store and execute program code, such asapplication-specific integrated circuits (“ASICs”), programmable logicdevices (“PLDs”) and ROM and RAM devices. Examples of computer codeinclude machine code, such as produced by a compiler, and filescontaining higher-level code that are executed by a computer using aninterpreter. For example, an embodiment of the invention may beimplemented using Java, C++, or other object-oriented programminglanguage and development tools. Another embodiment of the invention maybe implemented in hardwired circuitry in place of, or in combinationwith, machine-executable software instructions.

The foregoing description, for purposes of explanation, used specificnomenclature to provide a thorough understanding of the invention.However, it will be apparent to one skilled in the art that specificdetails are not required in order to practice the invention. Thus, theforegoing descriptions of specific embodiments of the invention arepresented for purposes of illustration and description. They are notintended to be exhaustive or to limit the invention to the precise formsdisclosed; obviously, many modifications and variations are possible inview of the above teachings. The embodiments were chosen and describedin order to best explain the principles of the invention and itspractical applications, they thereby enable others skilled in the art tobest utilize the invention and various embodiments with variousmodifications as are suited to the particular use contemplated. It isintended that the following claims and their equivalents define thescope of the invention.

APPENDIX I Table Of Acronyms AP Access Point ARFCN Absolute RF ChannelNumber ATM Asynchronous Transfer Mode ATM VC ATM Virtual Circuit BA BCCHAllocation BAS Broadband Access System BB Broadband BCCH BroadcastCommon Control Channel BRAS Broadband Remote Access System (e.g.,Redback Networks SMS) BSC Base Station Controller BSS Base StationSubsystem BSSGP Base Station System GPRS Protocol BSSMAP Base StationSystem Management Application Part BTS Base Transceiver Station CDMACode Division Multiple Access CGI Cell Global Identification CIC CircuitIdentity Code CLIP Calling Line Presentation CM Connection ManagementCPE Customer Premises Equipment CS Circuit Switched CVSD ContinuousVariable Slope Delta modulation DSL Digital Subscriber Line DSLAM DSLAccess Multiplexer DTAP Direct Transfer Application Part ETSI EuropeanTelecommunications Standards Institute FCAPS Fault-management,Configuration, Accounting, Performance, and Security FCC US FederalCommunications Commission GGSN Gateway GPRS Support Node GMM/SM GPRSMobility Management and Session Management GMSC Gateway MSC GSM GlobalSystem for Mobile Communication GPRS General Packet Radio Service GSNGPRS Support Node GTP GPRS Tunnelling Protocol HLR Home LocationRegister IAN Indoor Access Network (see also UMA Cell) IAN-RR IndoorAccess Network Radio Resource Management IBS Indoor Base Station. Theindoor base station is the fixed part of the customer premise solution.The indoor base station provides indoor unlicensed wireless coverage,and connects to the access network to enable indoor service delivery. AnIBS can be a single access point, or a set of access points with acentralized controller IBSAP IBS Application Protocol IBSMAP IBSManagement Application Protocol IEP IAN Encapsulation Protocol IETFInternet Engineering Task Force IMEI International Mobile StationEquipment Identity IMSI International Mobile Subscriber Identity INCIndoor Network Controller INC Indoor Network Controller (also referredto as a UMA Network Controller (UNC)). The indoor network controller isthe component of the IAN network equipment that manages the indooraccess network, and provides the physical layer interface(s) to theaccess network. IP Internet Protocol ISDN Integrated Services DigitalNetwork ISP Internet Service Provider ISP IP Internet Service Provider'sIP Network (i.e., typically provided by broadband service provider) ISTIAN Secure Tunnel ISUP ISDN User Part ITP IAN Transfer Protocol LALocation Area LAI Location Area Identification LLC Logical Link ControlMAC Medium Access Control MAP Mobile Application Part MDN MobileDirectory Number MG Media Gateway MM Mobility Management MM MobilityManagement MS Mobile Station MSC Mobile Switching Center MSC MobileSwitching Center MSISDN Mobile Station International ISDN Number MSRNMobile Station Roaming Number MTP1 Message Transfer Part Layer 1 MTP2Message Transfer Part Layer 2 MTP3 Message Transfer Part Layer 3 NAPTNetwork Address and Port Translation NAT Network Address Translation NSNetwork Service PCM Pulse Code Modulation PCS Personal CommunicationServices PCS Personal Communications Services PLMN Public Land MobileNetwork POTS Plain Old Telephone Service PPP Point-to-Point ProtocolPPPoE PPP over Ethernet protocol PSTN Public Switched Telephone NetworkP-TMSI Packet Temporary Mobile Subscriber Identity QoS Quality ofService RA Routing Area RAC Routing Area Code RAI Routing AreaIdentification RAI Routing Area Identity RF Radio Frequency RFC Requestfor Comment (IETF Standard) RLC Radio Link Control RR Radio ResourceManagement RTCP Real Time Control Protocol RTCP Real Time ControlProtocol RTP Real Time Protocol RTP Real Time Protocol SAP ServiceAccess Point SCCP Signaling Connection Control Part SCO SynchronousConnection-Oriented SDCCH Standalone Dedicated Control Channel SGSNServing GPRS Support Node SMC Short Message Service Centre SMS ShortMessage Service SM-SC Short Message Service Centre SMS- Short MessageService Gateway MSC GMSC SMS- Short Message Service Interworking MSCIWMSC SNDCP SubNetwork Dependent Convergence Protocol SS SupplementaryService SSL Secure Sockets Layer TCAP Transaction CapabilitiesApplication Part TCP Transmission Control Protocol TCP TransmissionControl Protocol TLLI Temporary Logical Link Identity TMSI TemporaryMobile Subscriber Identity TRAU Transcoder and Rate Adaptation Unit TTYText telephone or teletypewriter UDP User Datagram Protocol UMA CellUnlicensed Mobile Access Cell (see also IAN) UMTS Universal MobileTelecommunication System UNC UMA Network Controller (see also INC) VLRVisited Location Register VMSC Visited MSC WLAN Wireless Local AreaNetwork WSP IP Wireless Service Provider's IP Network (i.e., provider ofIAN service)

1. A method for locating an unlicensed mobile access (UMA) subscriber,comprising: establishing, using a mobile station (MS) supporting bothUMA and licensed wireless network sessions, a first UMA session with aUMA service provider; identifying an access point (AP) used to providean unlicensed wireless link to host the first UMA session; determiningif location information is available for the AP; when the locationinformation is not available, employing a licensed wirelessnetwork-based location service to identify the location of the MS; andstoring location information for the MS obtained via the licensedwireless network-based location service as a location for the AP, saidlocation information made accessible to the UMA service provider.
 2. Themethod of claim 1, further comprising: establishing a second UMA sessionwith the UMA service provider using the same AP as the first UMAsession; forwarding information identifying the AP to the UMA serviceprovider; retrieving the location for the AP; and employing the locationof the AP as the location of the UMA subscriber.
 3. A method forlocating an unlicensed mobile access (UMA) subscriber, comprising:establishing, using a mobile station (MS) supporting both UMA andlicensed wireless network sessions, a first UMA session with a UMAservice provider; identifying an access point (AP) used to provide anunlicensed wireless link to host the first UMA session, wherein the APis communicably coupled to a UMA network controller (UNC) operated bythe UMA service provider; determining if location information isavailable for the AP; when the location information is not available,employing a licensed wireless network-based location service to identifythe location of the MS; and sending a location service request to agateway mobile location center (GMLC).
 4. The method of claim 3, whereinthe location service request comprises a Location Inter-operabilityForum Mobile Location Protocol (LIF MLP) message.
 5. A method forlocating an unlicensed mobile access (UMA) subscriber, comprising:establishing, using a mobile station (MS) supporting both UMA andlicensed wireless network sessions, a first UMA session with a UMAservice provider; identifying an access point (AP) used to provide anunlicensed wireless link to host the first UMA session; determining iflocation information is available for the AP; when the locationinformation is not available, employing a licensed wirelessnetwork-based location service to identify the location of the MS;sending a register message including a medium access control (MAC)address of the AP and an international mobile subscriber identity (IMSI)for the MS from the MS to the UNC; determining the location of the AP;and returning a register acknowledgment message to the MS to registerthe MS with the UMA service.
 6. A method for locating an unlicensedmobile access (UMA) subscriber, comprising: establishing, using a mobilestation (MS) supporting both UMA and licensed wireless network sessions,a first UMA session with a UMA service provider; identifying an accesspoint (AP) used to provide an unlicensed wireless link to host the firstUMA session; determining if location information is available for theAP; and when the location information is not available, employing alicensed wireless network-based location service to identify thelocation of the MS, wherein location of the MS is determined byemploying at least one of Assisted GPS (AGPS), Angle of Arrival (AOA),Enhanced Observed Time Difference (E−OD), Cell Identity plus TimingAdvance (Cell ID+TA), and Time Difference of Arrival (TDOA) locationtechniques.
 7. A system comprising: an unlicensed mobile access (UMA)network controller (UNC) operable to communicate with atelecommunications network and communicably coupled to one or moreunlicensed wireless base stations comprising wireless access points (AP)that support communication with one or more mobile stations (MS) viaunlicensed wireless links, each MS configured to support both UMAsessions and licensed wireless network sessions; and a serviceprovisioning server, communicably coupled to the UNC, to store datacorresponding to UMA subscriber services provided by an operator of theUNC, wherein the UNC is operable to perform operations to support theUMA subscriber services, including: establishing a first UMA session fora MS; identifying an AP used to provide an unlicensed wireless link usedto host the first UMA session; determining if location information isavailable for the AP via the service provisioning server; when thelocation information is not available, submitting a location servicerequest to a licensed wireless network-based location service toidentify the location of the MS; and storing location informationreturned by the licensed wireless network-based location serviceidentifying the location of the MS as the location of the AP.
 8. Thesystem of claim 7, wherein the UNC is operable to provide a locationidentifier to a public safety access point when the MS initiates anemergency services call during a UMA session.
 9. The system of claim 7,wherein the location service request comprises a LocationInter-operability Forum Mobile Location Protocol (LIF MLP) message. 10.The system of claim 7, wherein the UNC is communicably coupled to a GSMnetwork, and the UNC is configured to provide the functions of a GSMbase station controller.
 11. The system of claim 7, wherein the UNC iscommunicably coupled to a mobile service center for the GSM network viaan A-interface.
 12. The system of claim 7, wherein the UNC iscommunicably coupled to a Serving GPRS (General Packet Radio Service)Support Node (SGSN) for the GSM network via a Gb-interface.
 13. Thesystem of claim 7, wherein the MS is configured to communicate with theAP via an IEEE 802.11-based unlicensed wireless link.
 14. The system ofclaim 7, wherein the MS is configured to communicate with the AP via aBluetooth-based unlicensed wireless link.
 15. The system of claim 7,wherein the UNC is further operable to: establish a second UMA sessionwith an MS via the same AP used to access the first UMA session; anddetermining the location of a subscriber using the MS by retrieving alocation record for the AP from the service provisioning server.
 16. Amethod for locating an unlicensed mobile access (UMA) subscriber,comprising: establishing, using a mobile station (MS) supporting bothUMA and licensed wireless network sessions, a first UMA session with aUMA service provider; identifying an access point (AP) used to providean unlicensed wireless link to host the first UMA session; determiningif location information is available for the AP; and when the locationinformation is not available, employing a licensed wirelessnetwork-based location service to identify the location of the MS,wherein said location information comprises a location estimate, whereinthe location estimate comprises geographic longitude and geographiclatitude.
 17. The method of claim 16, wherein the MS is configured tocommunicate with the AP via an unlicensed wireless network link.
 18. Amethod for locating an unlicensed mobile access (UMA) subscriber,comprising: establishing, using a mobile station (MS) supporting bothUMA and licensed wireless network sessions, a first UMA session with aUMA service provider; identifying an access point (AP) used to providean unlicensed wireless link to host the first UMA session; determiningif location information is available for the AP; and when the locationinformation is not available, employing a licensed wirelessnetwork-based location service to identify the location of the MS,wherein said location information comprises a location estimate, whereinthe location estimate comprises a street address.
 19. The method ofclaim 18, wherein the access point comprises an IEEE 802.11-based APthat hosts an IEEE 802.11-based wireless local area network (WLAN). 20.The method of claim 18, wherein the access point comprises Bluetooth APthat hosts a Bluetooth personal local area network (PLAN).